program: r0 = syz_open_dev$dri(&(0x7f0000000340), 0x2, 0x40502) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') pread64(r1, &(0x7f00000010c0)=""/4096, 0x1000, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_WAIT(r0, 0xc02864c3, &(0x7f0000000540)={&(0x7f0000000380)=[r2], 0x5, 0x400000ff, 0x2}) [ 85.143973][ T4673] Bluetooth: hci0: command tx timeout [ 85.252671][ T5332] ------------[ cut here ]------------ [ 85.255221][ T5332] WARNING: CPU: 0 PID: 5332 at mm/page_alloc.c:4935 __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.260100][ T5332] Modules linked in: [ 85.261909][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted 6.16.0-rc2-syzkaller-00278-g3f75bfff44be #0 PREEMPT(full) [ 85.267245][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.272841][ T5332] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.276091][ T5332] Code: 74 10 4c 89 e7 89 54 24 0c e8 74 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 5a 36 74 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 85.284667][ T5332] RSP: 0018:ffffc9000d46f920 EFLAGS: 00010246 [ 85.287361][ T5332] RAX: ffffc9000d46f900 RBX: 0000000000000015 RCX: 0000000000000000 [ 85.290630][ T5332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d46f988 [ 85.294048][ T5332] RBP: ffffc9000d46fa10 R08: ffffc9000d46f987 R09: 0000000000000000 [ 85.297500][ T5332] R10: ffffc9000d46f960 R11: fffff52001a8df31 R12: 0000000000000000 [ 85.300801][ T5332] R13: 1ffff92001a8df28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 85.304382][ T5332] FS: 00007fd59aa346c0(0000) GS:ffff88808d251000(0000) knlGS:0000000000000000 [ 85.309201][ T5332] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 85.312301][ T5332] CR2: 00002000000010c0 CR3: 000000003545f000 CR4: 0000000000352ef0 [ 85.316183][ T5332] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 85.320542][ T5332] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 85.324015][ T5332] Call Trace: [ 85.325556][ T5332] [ 85.326820][ T5332] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 85.329612][ T5332] ? kasan_save_free_info+0x46/0x50 [ 85.331769][ T5332] ? do_syscall_64+0xfa/0x3b0 [ 85.333862][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.336469][ T5332] __alloc_pages_noprof+0xa/0x30 [ 85.338800][ T5332] ___kmalloc_large_node+0x85/0x210 [ 85.341083][ T5332] __kmalloc_large_node_noprof+0x18/0x90 [ 85.343440][ T5332] __kmalloc_noprof+0x36f/0x4f0 [ 85.345647][ T5332] ? drm_syncobj_array_find+0x3a/0x450 [ 85.348301][ T5332] drm_syncobj_array_find+0x3a/0x450 [ 85.350626][ T5332] drm_syncobj_wait_ioctl+0x208/0x520 [ 85.352973][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.355424][ T5332] drm_ioctl_kernel+0x2cc/0x390 [ 85.357402][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.359716][ T5332] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 85.361860][ T5332] drm_ioctl+0x67f/0xb10 [ 85.363676][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.366221][ T5332] ? __pfx_drm_ioctl+0x10/0x10 [ 85.368513][ T5332] ? __fget_files+0x2a/0x420 [ 85.370555][ T5332] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.372738][ T5332] ? __pfx_drm_ioctl+0x10/0x10 [ 85.374805][ T5332] __se_sys_ioctl+0xfc/0x170 [ 85.376600][ T5332] do_syscall_64+0xfa/0x3b0 [ 85.378606][ T5332] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.380828][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.383402][ T5332] ? clear_bhb_loop+0x60/0xb0 [ 85.385549][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.388108][ T5332] RIP: 0033:0x7fd599b8e929 [ 85.390177][ T5332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.398924][ T5332] RSP: 002b:00007fd59aa34038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.402464][ T5332] RAX: ffffffffffffffda RBX: 00007fd599db5fa0 RCX: 00007fd599b8e929 [ 85.405832][ T5332] RDX: 0000200000000540 RSI: 00000000c02864c3 RDI: 0000000000000003 [ 85.409542][ T5332] RBP: 00007fd599c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 85.412805][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.416175][ T5332] R13: 0000000000000000 R14: 00007fd599db5fa0 R15: 00007ffed461f5c8 [ 85.419695][ T5332] [ 85.421197][ T5332] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 85.424220][ T5332] CPU: 0 UID: 0 PID: 5332 Comm: syz.0.0 Not tainted 6.16.0-rc2-syzkaller-00278-g3f75bfff44be #0 PREEMPT(full) [ 85.429127][ T5332] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 85.433334][ T5332] Call Trace: [ 85.434721][ T5332] [ 85.436015][ T5332] dump_stack_lvl+0x99/0x250 [ 85.438083][ T5332] ? __asan_memcpy+0x40/0x70 [ 85.439986][ T5332] ? __pfx_dump_stack_lvl+0x10/0x10 [ 85.442151][ T5332] ? __pfx__printk+0x10/0x10 [ 85.444114][ T5332] panic+0x2db/0x790 [ 85.445956][ T5332] ? __pfx_panic+0x10/0x10 [ 85.447878][ T5332] ? show_trace_log_lvl+0x4fb/0x550 [ 85.450138][ T5332] __warn+0x31b/0x4b0 [ 85.451893][ T5332] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.454386][ T5332] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.456935][ T5332] report_bug+0x2be/0x4f0 [ 85.458755][ T5332] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.461210][ T5332] ? __alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.463744][ T5332] ? __alloc_frozen_pages_noprof+0x2ca/0x370 [ 85.466204][ T5332] handle_bug+0x84/0x160 [ 85.468016][ T5332] exc_invalid_op+0x1a/0x50 [ 85.469948][ T5332] asm_exc_invalid_op+0x1a/0x20 [ 85.471974][ T5332] RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 [ 85.474712][ T5332] Code: 74 10 4c 89 e7 89 54 24 0c e8 74 14 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 5a 36 74 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24 [ 85.482534][ T5332] RSP: 0018:ffffc9000d46f920 EFLAGS: 00010246 [ 85.485085][ T5332] RAX: ffffc9000d46f900 RBX: 0000000000000015 RCX: 0000000000000000 [ 85.488393][ T5332] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000d46f988 [ 85.491663][ T5332] RBP: ffffc9000d46fa10 R08: ffffc9000d46f987 R09: 0000000000000000 [ 85.495065][ T5332] R10: ffffc9000d46f960 R11: fffff52001a8df31 R12: 0000000000000000 [ 85.498403][ T5332] R13: 1ffff92001a8df28 R14: 0000000000040cc0 R15: dffffc0000000000 [ 85.501707][ T5332] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 85.504392][ T5332] ? kasan_save_free_info+0x46/0x50 [ 85.506608][ T5332] ? do_syscall_64+0xfa/0x3b0 [ 85.508577][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.511156][ T5332] __alloc_pages_noprof+0xa/0x30 [ 85.513320][ T5332] ___kmalloc_large_node+0x85/0x210 [ 85.515497][ T5332] __kmalloc_large_node_noprof+0x18/0x90 [ 85.517903][ T5332] __kmalloc_noprof+0x36f/0x4f0 [ 85.519964][ T5332] ? drm_syncobj_array_find+0x3a/0x450 [ 85.522273][ T5332] drm_syncobj_array_find+0x3a/0x450 [ 85.524488][ T5332] drm_syncobj_wait_ioctl+0x208/0x520 [ 85.526721][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.529245][ T5332] drm_ioctl_kernel+0x2cc/0x390 [ 85.531290][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.533754][ T5332] ? __pfx_drm_ioctl_kernel+0x10/0x10 [ 85.537947][ T5332] drm_ioctl+0x67f/0xb10 [ 85.540177][ T5332] ? __pfx_drm_syncobj_wait_ioctl+0x10/0x10 [ 85.542706][ T5332] ? __pfx_drm_ioctl+0x10/0x10 [ 85.544722][ T5332] ? __fget_files+0x2a/0x420 [ 85.546704][ T5332] ? bpf_lsm_file_ioctl+0x9/0x20 [ 85.548769][ T5332] ? __pfx_drm_ioctl+0x10/0x10 [ 85.550713][ T5332] __se_sys_ioctl+0xfc/0x170 [ 85.552664][ T5332] do_syscall_64+0xfa/0x3b0 [ 85.554589][ T5332] ? lockdep_hardirqs_on+0x9c/0x150 [ 85.556778][ T5332] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.559288][ T5332] ? clear_bhb_loop+0x60/0xb0 [ 85.561242][ T5332] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 85.563692][ T5332] RIP: 0033:0x7fd599b8e929 [ 85.565640][ T5332] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 85.573464][ T5332] RSP: 002b:00007fd59aa34038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 85.577544][ T5332] RAX: ffffffffffffffda RBX: 00007fd599db5fa0 RCX: 00007fd599b8e929 [ 85.580793][ T5332] RDX: 0000200000000540 RSI: 00000000c02864c3 RDI: 0000000000000003 [ 85.583996][ T5332] RBP: 00007fd599c10b39 R08: 0000000000000000 R09: 0000000000000000 [ 85.587303][ T5332] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 85.590561][ T5332] R13: 0000000000000000 R14: 00007fd599db5fa0 R15: 00007ffed461f5c8 [ 85.593860][ T5332] [ 85.595480][ T5332] Kernel Offset: disabled [ 85.597305][ T5332] Rebooting in 86400 seconds..